ci.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: Continuous Integration
on:
  push:
    branches: ['**', '!renovate/**']
    tags: ['v*.*.*']
  pull_request:
    branches: [main, 'release/**']
  schedule:
    - cron: '30 5 * * *'

permissions:
  contents: read

jobs:
  vendored-sources:
    name: Vendored crypto source provenance
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Test source verification
        run: python3 -m unittest discover -s .github/scripts -p 'test_vendor_bouncycastle.py' -v

      - name: Verify published upstream sources and extraction
        run: |
          python3 .github/scripts/vendor_bouncycastle.py --check

  workflow-tests:
    name: Workflow scripts
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup mise
        uses: jdx/mise-action@6612f0ef07ed2a736cd1e00a94a065522dd41195 # v5.2.5
        with:
          install: true
          install_args: actionlint shellcheck

      - name: Check workflow syntax
        run: mise exec -- actionlint

  build:
    name: Build and test
    needs: vendored-sources
    if: ${{ !cancelled() }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      matrix:
        java: [17, 21, 25]
    steps:
      - name: Require reviewed vendored sources
        if: needs.vendored-sources.result != 'success'
        run: |
          echo 'Vendored SNTRUP provenance verification must pass before building or publishing.'
          exit 1

      - name: Checkout (with history)
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          fetch-tags: true
          persist-credentials: false
          # Sonar analyzes the PR head. Other matrix entries retain merge testing.
          ref: ${{ github.event_name == 'pull_request' && matrix.java == '25' && github.event.pull_request.head.sha || github.sha }}

      - name: Set up JDK ${{ matrix.java }}
        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
        with:
          distribution: 'zulu'
          java-version: ${{ matrix.java }}

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6.4.1
        with:
          dependency-graph: disabled
          validate-wrappers: true

      - name: Download TLA+ tools
        if: matrix.java == '17'
        env:
          TLA2TOOLS_SHA256: 936a262061c914694dfd669a543be24573c45d5aa0ff20a8b96b23d01e050e88
          TLA2TOOLS_URL: https://github.com/tlaplus/tlaplus/releases/download/v1.7.4/tla2tools.jar
        run: |
          tla2tools_jar="${RUNNER_TEMP}/tla2tools-1.7.4.jar"
          curl --fail --location --proto '=https' --tlsv1.2 \
            --output "${tla2tools_jar}" "${TLA2TOOLS_URL}"
          echo "${TLA2TOOLS_SHA256}  ${tla2tools_jar}" | sha256sum --check
          echo "TLA2TOOLS_JAR=${tla2tools_jar}" >> "${GITHUB_ENV}"

      - name: Check TLA+ models
        if: matrix.java == '17'
        run: ./gradlew :sshlib:checkTla

      - name: Configure Docker mirror
        run: |
          echo '{"registry-mirrors": ["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
          sudo systemctl restart docker

      - name: Build with Gradle
        run: ./gradlew --dependency-verification strict build koverXmlReport --info -PjdkVersion=${{ matrix.java }}

      - name: Measure Python source-verification coverage
        if: matrix.java == '25'
        run: |
          python3 -m venv build/python-coverage
          build/python-coverage/bin/pip install -r .github/scripts/requirements-coverage.txt
          build/python-coverage/bin/python -m coverage run -m unittest discover -s .github/scripts -p 'test_vendor_bouncycastle.py' -v
          build/python-coverage/bin/python -m coverage xml

      - name: Stage isolated analysis inputs
        if: matrix.java == '25'
        run: ./gradlew --dependency-verification strict stageSonarInputs

      - name: Upload isolated analysis inputs
        if: >-
          matrix.java == '25' &&
          (github.event_name == 'pull_request' || github.event_name == 'schedule' ||
           (github.event_name == 'push' && github.ref_type == 'branch' &&
            (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/'))))
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: sonar-inputs-${{ github.run_attempt }}
          path: build/sonar-inputs/
          if-no-files-found: error
          retention-days: 7

  publication:
    name: Attested Maven publication
    needs: [vendored-sources, workflow-tests, build]
    if: >-
      github.repository == 'connectbot/cbssh' && github.event_name == 'push' &&
      (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/') ||
       startsWith(github.ref, 'refs/tags/v'))
    permissions:
      contents: write
      actions: read
      id-token: write
      attestations: write
    uses: connectbot/actions/.github/workflows/publish-maven.yml@9b826116f0d49329fbe10985a5abdfa49562f0a0 # v0.2.0
    with:
      maven_group: org.connectbot.sshlib
      modules: protocol,sshlib,sshlib-webauthn
    secrets:
      MAVEN_GPG_PRIVATE_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
      MAVEN_GPG_KEYID: ${{ secrets.MAVEN_GPG_KEYID }}
      MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
      SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
      SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}